Multiple threat actors are targeting Elasticsearch Clusters

CVE-2014-3120 is a remote code execution flaw in Elasticsearch that arises when dynamic scripting is enabled, allowing remote attackers to submit arbitrary MVEL expressions and Java code that the cluster evaluates. It is triggered by sending crafted requests to the Elasticsearch API of a cluster where dynamic scripts are permitted, which is the default configuration in legacy releases. An attacker gains arbitrary Java code execution on the server, which public reporting shows being used for cryptojacking, DDoS botnets, and worm-like propagation. Any Elastic Elasticsearch deployment with dynamic scripting enabled is affected. The flaw is listed in CISA KEV (added 2022-03-25), carries an 88.6% EPSS score, and recent honeypot and botnet reporting indicates multiple threat actors are actively exploiting exposed Elasticsearch clusters.

Do: Apply updates per vendor instructions (the CISA KEV required action); current Elasticsearch releases no longer enable dynamic scripting by default, so upgrading removes the exposure. If upgrading is not immediately possible, disable dynamic scripting or restrict script execution, and limit exposure of the Elasticsearch API to trusted networks. Hunt for signs of compromise such as unexpected miner processes, outbound DDoS traffic, or worm-like lateral activity, since Talos honeypot data and WatchDog botnet reporting show this flaw being abused by multiple threat actors.

The Groovy scripting engine used by Elasticsearch for dynamic scripts (script fields, script-based sorting and queries) fails to properly confine user-supplied Groovy code, allowing a crafted script to escape the sandbox (CWE-284, improper access control) and invoke Java APIs such as Runtime to run arbitrary shell commands on the server. It is triggered remotely when an attacker who can reach the Elasticsearch HTTP API submits a malicious dynamic script (e.g., via the _search endpoint) on instances with dynamic scripting enabled. A successful attacker gains arbitrary command execution on the host running Elasticsearch, which can lead to full server compromise and follow-on activity such as malware or ransomware deployment. Affected deployments are Elasticsearch prior to 1.3.8 and 1.4.x prior to 1.4.3 (per public advisory records; the CISA source data lists no explicit version range), with fixes shipped in 1.3.8 and 1.4.3. The flaw is confirmed exploited in the wild — CISA added it to the KEV catalog on 2022-03-25 with ransomware use unknown — and EPSS ranks it in the 100th percentile (99.9% probability of exploitation within 30 days), though no public PoC is listed in the source data.

Do: Upgrade Elasticsearch to 1.3.8 (1.3.x) or 1.4.3 (1.4.x) or later, consistent with CISA's required action to apply updates per vendor instructions; as an interim mitigation, disable dynamic Groovy scripting (script.dynamic: false) and restrict port 9200 to trusted networks. Inventory internet-exposed instances (Shodan/Censys on port 9200), verify installed versions via the cluster's root endpoint, and hunt for signs of command execution such as unexpected processes, new cron/systemd entries, or outbound connections from Elasticsearch hosts.

Oracle WebLogic Server (CVE-2017-10271) contains a remote code execution flaw in its WLS Security component, where an XMLDecoder deserialization bug allows unauthenticated attackers to execute arbitrary code. The flaw is triggered by sending specially crafted XML requests to exposed WebLogic HTTP endpoints, so any instance whose WebLogic ports are reachable by untrusted users is at risk. Successful exploitation yields arbitrary code execution on the application server host, and the bug has been widely leveraged to install cryptominers and ransomware payloads. Organizations running Oracle WebLogic Server — particularly instances directly exposed to the internet — are affected, and the flaw has been on CISA's Known Exploited Vulnerabilities catalog since 2022-02-10 with confirmed ransomware use. Exploitation is assessed as essentially certain in the near term (EPSS 100.0%, 100th percentile), and defenders should treat it as an actively exploited, high-priority issue.

Do: Apply Oracle's updates for CVE-2017-10271 per Oracle's instructions (the vendor's required action for this KEV entry). Until patched, restrict network access to WebLogic HTTP/admin ports from untrusted networks and limit or remove access to the XML/WSAT endpoints used for exploitation. Because ransomware operators are known to exploit this flaw, review internet-exposed WebLogic instances for signs of compromise, such as unexpected processes, new scheduled tasks, webshells, or ransomware artifacts.

CVE-2018-1273 is a property binder flaw (CWE-94, improper neutralization of special elements leading to code injection) in Spring Data Commons, affecting versions 1.13.0 to 1.13.10, 2.0.0 to 2.0.5, and older unsupported releases. An unauthenticated remote attacker triggers it by sending specially crafted request parameters against Spring Data REST-backed HTTP resources or via Spring Data projection-based request payload binding. Successful exploitation yields remote code execution on the application host, reflected in the critical CVSS 3.1 score of 9.8 with network attack vector and no privileges or user interaction required. Any application built on the affected library and exposing the vulnerable binding paths is at risk, including deployments of Spring Data REST, Apache Ignite, and Oracle Financial Services Crime and Compliance Management Studio that bundle the library. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2022-03-25 with known ransomware use, EPSS rates a 97% probability of exploitation within 30 days (100th percentile), and related threat reporting shows active attacks against Java-based services, although no public PoC is catalogued in the source data.

Do: Apply vendor updates per the CISA KEV required action: upgrade Spring Data Commons past the last-affected releases 1.13.10 and 2.0.5 (i.e., 1.13.11 or 2.0.6 and later) or to the latest supported release. Inventory internet-facing Java applications for Spring Data REST endpoints and projection-based payload binding, patch or restrict those paths, and review application logs for exploitation activity given the known ransomware use.

CVE-2018-7600, widely known as 'Drupalgeddon 2', is an unauthenticated remote code execution flaw in Drupal Core caused by insufficient input validation (CWE-20) in how the CMS processes certain structured request data. It can be triggered through multiple attack vectors, such as crafted parameters submitted to commonly used form and rendering features that are reachable by anonymous users with a single HTTP request. Successful exploitation lets an attacker run arbitrary code under the web application, typically resulting in complete site compromise, and CISA notes the flaw has been used in ransomware operations. Any site running unpatched Drupal 7.x or 8.x core is affected; Drupal's installed base at the time of disclosure was on the order of one million sites. Exploitation is confirmed in the wild (CISA KEV, added 2021-11-03), EPSS assigns a 100% probability of exploitation within 30 days, and no public PoC is recorded in the supplied data.

Do: Upgrade immediately per vendor instructions: Drupal 7.58, 8.5.1, or the corresponding 8.4.6/8.3.9 updates if you remain on older 8.x branches, prioritizing internet-facing sites. Because this flaw has been exploited in the wild and used in ransomware operations, also check patched sites for backdoors, unexpected administrator accounts, modified core files, and rotate credentials.